CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.27)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
curl w wersjach od 7.20.0 do 7.70.0 jest podatny na niewłaściwe ograniczenie nazw plików i innych zasobów, co może prowadzić do nadpisania lokalnego pliku przy użyciu flagi -J.
In OpenAsset Digital Asset Management (DAM) version 12.0.19 and earlier, access controls are missing on the /Stream/ProjectsCSV endpoint, allowing unauthenticated attackers to access potentially sensitive project information stored by the application.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user input, incorporating it into SQL queries, allowing authenticated blind SQL injection.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly sanitize user-supplied input in multiple parameters and endpoints, allowing for reflected cross-site scripting (XSS) attacks.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not properly verify whether a request to the application was intentionally made by the user, allowing cross-site request forgery (CSRF) attacks on all user functions.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 fails to properly sanitize user-supplied input in multiple parameters and endpoints, allowing stored cross-site scripting (XSS) attacks.
OpenAsset Digital Asset Management (DAM) through version 12.0.19 does not correctly determine the originating IP address of HTTP requests, allowing attackers to spoof it using the X-Forwarded-For header, e.g., by supplying localhost address 127.0.0.1, effectively bypassing all IP-based access controls.
An SQL injection vulnerability in the WebAdmin of Cyberoam OS through 2020-12-04 allows unauthenticated attackers to execute arbitrary SQL statements remotely.
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
A remote code execution vulnerability in Microsoft Exchange. Technical details are not provided in the description.
A vulnerability in the Windows Cloud Files Mini Filter Driver allows for elevation of privilege. An attacker can exploit this flaw to gain higher privileges on the system.
Vulnerability in Firefox for Android related to the Remote Debugging via USB feature, which was enabled on Android versions prior to 6.0. Untrusted apps could connect to the feature and operate with browser privileges to read and interact with web content.
OneCRL was non-functional in the new Firefox for Android due to a missing service initialization. This could result in a failure to enforce some certificate revocations. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. Affects Firefox < 83.
When a user downloaded a file in Firefox for Android, if a cookie is set, it would be re-sent during a subsequent file download on the same domain, regardless of private or non-private browsing modes. Affects Firefox < 83.
When accepting a malicious intent from other installed apps, Firefox for Android accepted manifests from arbitrary file paths and allowed declaring webapp manifests for other origins. This could be used to gain fullscreen access for UI spoofing and could also lead to cross-origin attacks on targeted websites. This vulnerability affects Firefox < 83.
A memory initialization issue was addressed. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7 Supplemental Update, macOS Catalina 10.15.7 Update. A malicious application may be able to disclose kernel memory.
A type confusion issue was addressed with improved state handling. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. A malicious application may be able to execute arbitrary code with kernel privileges.
A memory corruption issue was addressed with improved input validation. The issue affects multiple Apple operating systems: macOS, watchOS, iOS, and iPadOS. Processing a maliciously crafted font may lead to arbitrary code execution.
Typ GeneralName w X.509 jest używany do reprezentowania różnych typów nazw, w tym EDIPartyName. Funkcja GENERAL_NAME_cmp w OpenSSL porównuje instancje GENERAL_NAME, ale w przypadku EDIPARTYNAME może prowadzić do dereferencji wskaźnika NULL i awarii, co może skutkować atakiem typu denial of service.
Apache Groovy provides extension methods to aid with creating temporary directories. Prior to this fix, Groovy's implementation of those extension methods was using a now superseded Java JDK method call that is potentially not secure on some operating systems in some contexts. Affected versions: 2.0 to 2.4.20, 2.5.0 to 2.5.13, 3.0.0 to 3.0.6, and 4.0.0-alpha-1. Fixed in versions 2.4.21, 2.5.14, 3.0.7, 4.0.0-alpha-2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS